Allow transfer of project with registry tags

What does this MR do and why?

In this MR, we start to allow the transfer of projects with registry tags given the following conditions:

1. Feature flag transfer_project_with_tags is enabled
2. The GitLab API is supported (i.e. metadata database is enabled in the registry)
3. The transfer is within the same top level namespace

Before the actual transfer, we also do a dry run of the command in the container registry API, and only if it succeeds will the transfer proceed, otherwise an error will be raised.

We use ContainerRegistry::GitlabApiClient.move_repository_to_namespace which was the recently added in #475000 (closed).

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

Prerequisites:

1. The metadata database is enabled
2. Redis is running (redis-server --port 6380)
3. Groups and subgroups. In the sample below, we would move ProjectOne from Subgroup A to Subgroup B which would be allowed. We will also try to move ProjectOne to Group2 which would result to an error since Group2 is not in the same top-level namespace. Make sure that ProjectOne has container images and tags so we can test this update

• Group 1
  • Subgroup A
    • ProjectOne
  • Subgroup B
• Group 2

A. When the feature flag is disabled

1. Verify that the feature flag is disabled

Feature.disabled?(:transfer_project_with_tags)
# => true

# if the feature is enabled, you can disable it with:
Feature.disable(:transfer_project_with_tags)

2. Transfer the project to another group within the same top level namespace in Settings > General > Advanced > Transfer project

3. You should get an error that the operation is not allowed due to tags.

Project cannot be transferred, because tags are present in its container registry

B. When the feature flag is enabled and transfer in the same top level namespace

1. Verify that the feature flag is enabled

Feature.enabled?(:transfer_project_with_tags)
# => true

# if the feature is disabled, you can enable it with:
Feature.enable(:transfer_project_with_tags)

2. Transfer the project to another group within the same top level namespace in Settings > General > Advanced > Transfer project

3. It should be successful After the transfer, check the Container Registry page for the project and check that the container images and tags are still visible.

Screenshot: Container Registry page

C. When the feature flag is enabled and transfer NOT IN the same top level namespace

1. Verify that the feature flag is enabled

Feature.enabled?(:transfer_project_with_tags)
# => true

# if the feature is disabled, you can enable it with:
Feature.enable(:transfer_project_with_tags)

2. Transfer the project to another group that is not within the same top level namespace in Settings > General > Advanced > Transfer project

3. There should be an error that it is not allowed to transfer projects with registry tags to a different top level namespace.

Related to #499163 (closed)

app/services/projects/transfer_service.rb

@@ -92,10 +92,7 @@ def transfer(project)
         raise TransferError, s_("TransferProject|Project with same name or path in target namespace already exists")
       end
 
-      if project.has_container_registry_tags?
-        # We currently don't support renaming repository if it contains tags in container registry
-        raise TransferError, s_('TransferProject|Project cannot be transferred, because tags are present in its container registry')
-      end
+      verify_if_container_registry_tags_can_be_handled(project)
 
       if !new_namespace_has_same_root?(project) && project.has_namespaced_npm_packages?
         raise TransferError, s_("TransferProject|Root namespace can't be updated if the project has NPM packages scoped to the current root level namespace.")
@@ -105,6 +102,33 @@ def transfer(project)
     end
     # rubocop: enable CodeReuse/ActiveRecord
 
+    def verify_if_container_registry_tags_can_be_handled(project)
+      return unless project.has_container_registry_tags?
+
+      raise_error_due_to_tags_if_transfer_is_not_allowed(project)
+      raise_error_due_to_tags_if_not_in_same_root(project)
+      raise_error_due_to_tags_if_transfer_dry_run_fails(project)
+    end
+
+    def raise_error_due_to_tags_if_transfer_is_not_allowed(project)
+      return if Feature.enabled?(:transfer_project_with_tags, project) && ContainerRegistry::GitlabApiClient.supports_gitlab_api? # rubocop disable Style/IfUnlessModifier
+
+      raise TransferError, s_('TransferProject|Project cannot be transferred, because image tags are present in its container registry')
+    end
+
+    def raise_error_due_to_tags_if_not_in_same_root(project)
+      return if new_namespace_has_same_root?(project)
+
+      raise TransferError, s_('TransferProject|Project cannot be transferred to a different top-level namespace, because image tags are present in its container registry')
+    end
+
+    def raise_error_due_to_tags_if_transfer_dry_run_fails(project)
+      dry_run = transfer_project_path_in_registry(project.full_path, new_namespace.full_path, dry_run: true)
+      return if dry_run == :accepted
+
+      raise TransferError, format(s_('TransferProject|Project cannot be transferred because of a container registry error: %{error}'), error: dry_run.to_s.titleize)
+    end
+
     def new_namespace_has_same_root?(project)
       new_namespace.root_ancestor == project.namespace.root_ancestor
     end
@@ -129,6 +153,11 @@ def proceed_to_transfer
           # Move uploads
           move_project_uploads(project)
 
+          # Update Container Registry
+          if project.has_container_registry_tags?
+            transfer_project_path_in_registry(@old_path, @new_namespace.full_path, dry_run: false)
+          end
+
           update_integrations
 
           project.old_path_with_namespace = @old_path
@@ -152,6 +181,14 @@ def proceed_to_transfer
       refresh_permissions
     end
 
+    def transfer_project_path_in_registry(old_project_path, new_namespace_path, dry_run:)
+      ContainerRegistry::GitlabApiClient.move_repository_to_namespace(
+        old_project_path,
+        namespace: new_namespace_path,
+        dry_run: dry_run
+      )
+    end
+
     # Overridden in EE
     def post_update_hooks(project, _old_group)
       ensure_personal_project_owner_membership(project)